[CONF] Apache CXF > Security Advisories

[Colm O hEigeartaigh (Confluence)]

Security Advisories Page edited by Colm O hEigeartaigh Changes (3) h3. 2013 * [CVE-2013-2160|^CVE-2013-2160.txt.asc] - Denial of Service Attacks on Apache CXF * [Note on CVE-2012-5575|CVE-2012-5575] - XML Encryption backwards compatibility attack on Apache CXF. * [CVE-2013-0239|CVE-2013-0239] - Authentication bypass in the case of WS-SecurityPolicy enabled plaintext UsernameTokens. h3. 2012 * [CVE-2012-5633|CVE-2012-5633] - WSS4JInInterceptor always allows HTTP Get requests from browser. * [Note on CVE-2011-2487|Note on CVE-2011-2487] - Bleichenbacher attack against distributed symmetric key in WS-Security. ... * [Note on CVE-2011-1096|Note on CVE-2011-1096] - XML Encryption flaw / Character pattern encoding attack. * [CVE-2012-0803|CVE-2012-0803] - Apache CXF does not validate UsernameToken policies correctly. h3. 2010 * [CVE-2010-2076|http://svn.apache.org/repos/asf/cxf/trunk/security/CVE-2010-2076.pdf] - DTD based XML attacks. Full Content 2013 [CVE-2013-2160|^CVE-2013-2160.txt.asc] - Denial of Service Attacks on Apache CXF Note on CVE-2012-5575 - XML Encryption backwards compatibility attack on Apache CXF. CVE-2013-0239 - Authentication bypass in the case of WS-SecurityPolicy enabled plaintext UsernameTokens. 2012 CVE-2012-5633 - WSS4JInInterceptor always allows HTTP Get requests from browser. Note on CVE-2011-2487 - Bleichenbacher attack against distributed symmetric key in WS-Security. CVE-2012-3451 - Apache CXF is vulnerable to SOAP Action spoofing attacks on Document Literal web services. CVE-2012-2379 - Apache CXF does not verify that elements were signed or encrypted by a particular Supporting Token. CVE-2012-2378 - Apache CXF does not pick up some child policies of WS-SecurityPolicy 1.1 SupportingToken policy assertions on the client side. Note on CVE-2011-1096 - XML Encryption flaw / Character pattern encoding attack. CVE-2012-0803 - Apache CXF does not validate UsernameToken policies correctly. 2010 CVE-2010-2076 - DTD based XML attacks. Stop watching space | Change email notification preferences View Online | View Changes | Add Comment